Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
Packagist phpseclib/phpseclib · Upgrade to 3.0.50, 2.0.52 or 1.0.27 by release line · >= 3.0.0, <= 3.0.49; >= 2.0.0, <= 2.0.51; >= 0.1.1, <= 1.0.26 · CVE-2026-32935 · GHSA-94g3-g5v7-q4jg
Go github.com/autobrr/qui · Upgrade to 1.15.0 or later · < 1.15.0 · CVE-2026-30924 · GHSA-h8vw-ph9r-xpch
Go github.com/smallstep/certificates · Upgrade to 0.30.0 or later · < 0.30.0 · CVE-2026-30836 · GHSA-q4r8-xm5f-56gw
PyPI ormar · Upgrade to 0.23.1 or later · <= 0.23.0 · CVE-2026-27953 · GHSA-f964-whrq-44h8 · amended
RubyGems json · Upgrade to 2.19.2, 2.17.1.2 or 2.15.2.1 by release line · >= 2.18.0, < 2.19.2; >= 2.16.0, < 2.17.1.2; >= 2.14.0, < 2.15.2.1 · CVE-2026-33210 · GHSA-3m6g-2423-7cp3
crates.io salvo · Upgrade to 0.89.3 or later · < 0.89.3 · CVE-2026-33241 · GHSA-pp9r-xg4c-8j4x
crates.io salvo · Upgrade to 0.89.3 or later · >= 0.39.0, <= 0.89.2 · CVE-2026-33242 · GHSA-f842-phm9-p4v4
Go github.com/modelcontextprotocol/go-sdk · Upgrade to 1.4.1 or later · <= 1.4.0 · GHSA-q382-vc8q-7jhj
PyPI nltk · Upgrade to 3.9.4 or later · < 3.9.4 · CVE-2026-33236 · GHSA-469j-vmhf-r6v7 · amended
PyPI nltk · Upgrade to 3.9.4 or later · <= 3.9.3 · CVE-2026-33231 · GHSA-jm6w-m3j8-898g · amended
npm @anthropic-ai/claude-code · Upgrade to 2.1.53 or later · < 2.1.53 · CVE-2026-33068 · GHSA-mmgp-wc2j-qcv7 · amended
PyPI mlflow · Upgrade to 3.9.0rc0 (pre-release) or later · < 3.9.0rc0 · CVE-2025-15031 · GHSA-fhff-qmm8-h2fp · amended
Go github.com/tektoncd/pipeline · Upgrade to 1.10.2, 1.9.2, 1.6.1 or 2 more by release line · >= 1.0.0, < 1.0.1; >= 1.1.0, < 1.3.3; >= 1.4.0, < 1.6.1; >= 1.7.0, < 1.9.2; >= 1.10.0, < 1.10.2 · CVE-2026-33211 · GHSA-j5q5-j9gm-2w5c
Go github.com/russellhaering/gosaml2 · Upgrade to 0.11.0 or later · <= 0.10.0 · GHSA-pcgw-qcv5-h8ch
Go github.com/russellhaering/gosaml2 · Upgrade to 0.11.0 or later · <= 0.10.0 · GHSA-hwqm-qvj9-4jr2
Go github.com/russellhaering/goxmldsig · Upgrade to 1.6.0 or later · <= 1.5.0 · CVE-2026-33487 · GHSA-479m-364c-43vc
Packagist kelvinmo/simplejwt · Upgrade to 1.1.1 or later · <= 1.1.0 · CVE-2026-33204 · GHSA-xw36-67f8-339x
Go github.com/free5gc/udm · Upgrade to 1.4.2 or later · < 1.4.2 · CVE-2026-33192 · GHSA-5rvc-5cwx-g5x8
Go github.com/free5gc/udm · Upgrade to 1.4.2 or later · < 1.4.2 · CVE-2026-33191 · GHSA-p9hg-pq3q-v9gv
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 3.6.2 or later · < 3.6.2 · CVE-2026-33203 · GHSA-3g9h-9hp4-654v · amended
Go google.golang.org/grpc · Upgrade to 1.79.3 or later · < 1.79.3 · CVE-2026-33186 · GHSA-p77j-4mvh-x3m3
PyPI deepdiff · Upgrade to 8.6.2 or later · >= 5.0.0, <= 8.6.1 · CVE-2026-33155 · GHSA-54jj-px8x-5w5q · amended
PyPI dynaconf · Upgrade to 3.2.13 or later · <= 3.2.12 · CVE-2026-33154 · GHSA-pxrr-hq57-q35p · amended
Maven ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli +11 · Upgrade all 12 to 6.9.0 or later · < 6.9.0 · CVE-2026-33180 · GHSA-p7m9-v2cm-2h7m
Packagist filament/tables · Upgrade to 5.3.5 or 4.8.5 by release line · >= 4.0.0, < 4.8.5; >= 5.0.0, < 5.3.5 · CVE-2026-33080 · GHSA-vv3x-j2x5-36jc
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.